Spending Authority

{
  "capabilities": {
    "extendedAgentCard": false,
    "extensions": [
      {
        "description": "MCP server exposing request_mandate and get_policy over streamable-HTTP.",
        "params": {
          "discoveryUrl": "https://authority.webmesh.ai/.well-known/mcp.json",
          "endpoint": "https://authority.webmesh.ai/mcp",
          "protocolVersion": "2025-03-26",
          "transport": "streamable-http"
        },
        "required": false,
        "uri": "https://modelcontextprotocol.io"
      },
      {
        "description": "Identity and interoperability stack: ANS Trust Card (x5c chain + stapled SCITT receipt), DNS-AID SVCB with DNSSEC and DANE TLSA, DNSid organizational accountability, ARD / AI-Catalog discovery, and Web Bot Auth (RFC 9421 HTTP Message Signatures) outbound request signing.",
        "params": {
          "agentFacts": "https://authority.webmesh.ai/agentfacts.json",
          "ard": "https://authority.webmesh.ai/.well-known/ard.json",
          "httpMessageSignaturesDirectory": "https://authority.webmesh.ai/.well-known/http-message-signatures-directory",
          "identityAnchors": [
            "ans-x509",
            "did:web",
            "dns-aid",
            "dnssec",
            "dane-tlsa",
            "dnsid"
          ],
          "outboundSigning": "web-bot-auth",
          "trustCard": "https://authority.webmesh.ai/.well-known/ans/trust-card.json"
        },
        "required": false,
        "uri": "https://webmesh.ai/ext/ans-trust-stack/v1"
      }
    ],
    "pushNotifications": false,
    "streaming": false
  },
  "defaultInputModes": [
    "text/plain",
    "application/json"
  ],
  "defaultOutputModes": [
    "application/json",
    "text/plain"
  ],
  "description": "The human's spending policy as a machine-verifiable instrument. Approves once and issues narrowly scoped RFC 9421 AP2 mandates with DPoP key binding (jkt). Stubbed Auth0 consent for the demo; mandate is the wire artifact the Supplier verifies and the Auditor checks.",
  "documentationUrl": "https://agent.webmesh.ai",
  "name": "Spending Authority",
  "protocolVersion": "1.0",
  "provider": {
    "did": "did:web:authority.webmesh.ai",
    "organization": "Webmesh",
    "url": "https://webmesh.ai"
  },
  "securityRequirements": [
    {
      "noAuth": []
    }
  ],
  "securitySchemes": {
    "ansIdentityCert": {
      "description": "ANS Identity Certificate issued by the ANS Registration Authority. The agent presents this cert during the TLS handshake; clients verify against the chain advertised in the Trust Card's keys[].x5c. See https://authority.webmesh.ai/.well-known/ans/trust-card.json",
      "type": "mutualTLS"
    },
    "httpMessageSignatures": {
      "description": "RFC 9421 HTTP Message Signatures over response components, using the Ed25519 key advertised in the Trust Card. Public key directory at https://authority.webmesh.ai/.well-known/http-message-signatures-directory",
      "scheme": "signature",
      "type": "http"
    },
    "noAuth": {
      "description": "This agent is publicly accessible with no authentication required. All skills are available to any caller.",
      "type": "noAuth"
    },
    "requesterSignature": {
      "alg": "EdDSA",
      "boundArgs": [
        "subject_ans",
        "quote_id",
        "total",
        "currency",
        "merchant_ans",
        "scope_hint",
        "traveler_dpop_jwk"
      ],
      "denialCodes": [
        "REQUEST_NOT_SIGNED",
        "BAD_SIGNATURE",
        "STALE_REQUEST",
        "REPLAYED_REQUEST",
        "SUBJECT_MISMATCH",
        "ARGS_MISMATCH",
        "IDENTITY_UNVERIFIED",
        "INSUFFICIENT_FUNDS"
      ],
      "description": "Caller must include request_jws: a compact JWS (alg=EdDSA) signed with the caller's ANS identity Ed25519 key. Payload must bind: subject_ans, quote_id, total, currency, merchant_ans, scope_hint, traveler_dpop_jwk. Freshness: iat within 300 s of server time. Replay protection: jti stored per-request for 2x the freshness window; reuse is denied. JWKS discovery: authority resolves the caller's public key from {caller_host}/.well-known/jwks.json (internal loopback when GOVWARE_JWKS_INTERNAL_{SUBDOMAIN} is set). Denial codes: REQUEST_NOT_SIGNED, BAD_SIGNATURE, STALE_REQUEST, REPLAYED_REQUEST, SUBJECT_MISMATCH, ARGS_MISMATCH, IDENTITY_UNVERIFIED, INSUFFICIENT_FUNDS.",
      "format": "compact-jws",
      "freshnessSecs": 300,
      "in": "toolArgument",
      "jwksDiscovery": "caller-ans-jwks",
      "name": "request_jws",
      "replayProtection": "jti-dedup",
      "type": "requesterJws"
    }
  },
  "signatures": [
    {
      "header": {
        "kid": "_JgCdyejGF0u-RjeiykAkPxn9PS8zhnwRRZNnPEfEmE"
      },
      "protected": "eyJhbGciOiJFUzI1NiIsImprdSI6Imh0dHBzOi8vYXV0aG9yaXR5LndlYm1lc2guYWkvLndlbGwta25vd24vYW5zL3RydXN0LWNhcmQuanNvbiIsImtpZCI6Il9KZ0NkeWVqR0YwdS1SamVpeWtBa1B4bjlQUzh6aG53UlJaTm5QRWZFbUUiLCJ0eXAiOiJhZ2VudC1jYXJkK2p3cyJ9",
      "signature": "1GFhbK6dJrGIxt7rCH8a1btLaLqu711-rmw98vFDMH3tLDBZMLlV35Mjypj-UhZ8kObou9njkthagnZ16zVWLg"
    }
  ],
  "skills": [
    {
      "description": "Issue a signed AP2 mandate with DPoP key binding (jkt). Requires a compact EdDSA JWS (request_jws) signed by the caller's ANS identity key, binding subject_ans, quote_id, total, currency, merchant_ans, scope_hint, and traveler_dpop_jwk. Freshness window: 300 s. Replay protection: jti must be unique. JWKS fetched from the caller's ANS JWKS endpoint.",
      "examples": [
        "Approve $620 flight to a destination"
      ],
      "id": "request_mandate",
      "inputModes": [
        "application/json"
      ],
      "name": "Issue Mandate",
      "outputModes": [
        "application/json"
      ],
      "securityRequirements": [
        {
          "requesterSignature": {
            "scope": "purchase:flight:*"
          }
        }
      ],
      "tags": [
        "mandate",
        "authorization",
        "dpop",
        "requester-signature"
      ]
    },
    {
      "description": "Return the current spending policy (max_per_trip, currency, allowed_merchants, categories).",
      "examples": [
        "What is the spending policy?"
      ],
      "id": "get_policy",
      "inputModes": [
        "application/json"
      ],
      "name": "Get Policy",
      "outputModes": [
        "application/json"
      ],
      "securityRequirements": [
        {
          "noAuth": []
        }
      ],
      "tags": [
        "mandate",
        "policy"
      ]
    }
  ],
  "supportedInterfaces": [
    {
      "protocolBinding": "jsonrpc",
      "protocolVersion": "1.0",
      "url": "https://authority.webmesh.ai"
    }
  ],
  "url": "https://authority.webmesh.ai",
  "version": "1.0.4",
  "x-discovery": {
    "ans_name": "ans://v1.0.4.authority.webmesh.ai",
    "ans_registered": "prod",
    "dns_aid_svcb": "authority.webmesh.ai IN SVCB 1 . alpn=a2a,h2",
    "tl_badge": "https://transparency.ans.godaddy.com/v1/agents/db1eaddb-a1dc-42a4-a76a-f72e5719408f",
    "trust_index": {
      "auth": "sso-key",
      "score_field": "scores.trustScore",
      "score_url": "https://api.godaddy.com/v1/ans/registered-agents?query=authority.webmesh.ai"
    }
  },
  "x-identity": {
    "ans": {
      "transparencyLog": "https://transparency.ans.godaddy.com/v1/agents/db1eaddb-a1dc-42a4-a76a-f72e5719408f",
      "trustCard": "https://authority.webmesh.ai/.well-known/ans/trust-card.json",
      "uri": "ans://v1.0.4.authority.webmesh.ai"
    },
    "wimse": {
      "jwksUri": "https://authority.webmesh.ai/.well-known/jwks.json",
      "signingAlgs": [
        "EdDSA"
      ],
      "spiffeId": "spiffe://webmesh.ai/agents/authority",
      "supportedProfiles": [
        "urn:ietf:params:wimse:agent-delegation-chain"
      ]
    }
  },
  "x-security-note": "request_mandate enforces requester-identity verification: callers must include a compact EdDSA JWS (request_jws) signed with their ANS identity key, binding the mandate arguments. The authority fetches the caller's public key from their ANS JWKS endpoint and verifies argument binding, freshness (300 s window), and replay (jti dedup). get_policy is unauthenticated (noAuth). Denial codes: REQUEST_NOT_SIGNED, BAD_SIGNATURE, STALE_REQUEST, REPLAYED_REQUEST, SUBJECT_MISMATCH, ARGS_MISMATCH, IDENTITY_UNVERIFIED, INSUFFICIENT_FUNDS."
}